High Sec Labs K404F User manual

1
Secure Combiner KVM Switch User Manual
User Manual: Combiner KVM Switches (K404F, K424F)
User Manual
Models covered in this user manual:
K404F: Secure 4-port DVI Combiner KVM Switch w/audio & DPP
K424F: Secure 4-port Dual-Head DVI Combiner KVM Switch w/audio & DPP
Rev: 2.4

2
Secure Combiner KVM Switch User Manual
Table of Content
Introduction ....................................................................................... 3
Package Contents............................................................................... 3
Security Features ............................................................................... 4
Main Features .................................................................................... 6
Equipment Requirements .................................................................. 7
Safety Precautions ............................................................................. 8
Front Panel Features.......................................................................... 9
Rear Panel Features ......................................................................... 10
Tamper Evident Labels..................................................................... 11
Active Anti-Tampering System......................................................... 11
Product Specifications...................................................................... 12
Before Installation............................................................................ 14
Installation ....................................................................................... 16
Administrator Setup......................................................................... 19
Operation......................................................................................... 21
DPP Operation.................................................................................. 23
Single Display Viewing Options........................................................ 27
Dual Display Viewing Options .......................................................... 29
Summary of Actions......................................................................... 30
Troubleshooting Guide .................................................................... 32
Copyright and Legal Notice.............................................................. 35
Record of Revisions
Rev
Date
Description of changes
1.0
Nov 11, 2010
Initial release
1.1
Nov 20, 2011
Internal review for CC evaluation
2.1
Dec 30, 2011
Released for customers
2.2
Feb 4, 2012
Added security procedures text
2.3
April 19, 2012
Added support for composite
device
2.4
April 3 2015
Updates

3
Secure Combiner KVM Switch User Manual
Introduction
Thank you for purchasing this HSL Secure Combiner KVM Switch.
There are many cases where one user needs to work simultaneously
with several computers. The Secure KVM Combiner is designed to
provide users with native windowing environment across isolated
networks.
The HSL Secure KVM Combiner switch uses advanced video
processing technology to draw a high resolution dynamic “mosaic” of
images generated by different computer sources. Built-in video
sources isolation forces unidirectional flow of data through the USB
and video ports. The product was designed and certified according to
NIAP standards.
This User Manual provides all the details you’ll need to install and
operate your new Switch, in addition to troubleshooting guidance—
in the unlikely event of a problem.
Package Contents
Inside product packaging you will find the following:
HSL Secure KVM Product
DC Power Supply
5-button Mouse
User Guidance Documentation
Important Security Note:
If you are aware of potential security vulnerability while
installing or operating this product, we encourage you to
contact us immediately in one of the following ways:
Web form: http://www.highseclabs.com/support/case/
Email: [e-mail]
Tel: [phone] or [phone]
Important: This product is equipped with always-on active anti-
tampering system. Any attempt to open the product enclosure
will activate the anti-tamper triggers and render the unit
inoperable and warranty void.
Important Security Note:
If you are aware of potential security vulnerability while
installing or operating this product, we encourage you to
contact us immediately in one of the following ways:
Web form: http://www.highseclabs.com/support/case/
Email: [e-mail]
Tel: [phone] or [phone]
Important: This product is equipped with always-on active anti-
tampering system. Any attempt to open the product enclosure
will activate the anti-tamper triggers and render the unit
inoperable and warranty void.

4
Secure Combiner KVM Switch User Manual
Security Features
HSL Secure KVM Switch is the most advanced and secure
commercially available KVM Switch available today. This product is a
derivative of high security KVM product used in newest NATO nuclear
submarines. Below is a summary of some of the security features
incorporated into the product.
Unidirectional Data Paths
Optical diodes used to enforce unidirectional data flow from the
peripheral devices to computers preventing potential leakage paths
between computers even in the severe threat of two infected
computers attacking the KVM.
No Shared Resources
This KVM Switch designed to securely operate even when peripheral
devices are vulnerable to signaling attacks. This KVM Switch does not
allow computer access to any shared resource and does not share
controllable power sources.
Dedicated Processors for Emulation
The Switch features a dedicated processor per computer port to
emulate peripheral devices. This keeps each computer running on
different security levels physically separated and secure at all times,
and prevents any unintended data leakage between computers.
Non-Reprogrammable Firmware
The Switch features custom firmware that is not reprogrammable,
preventing the ability to remotely attack the KVM control logic.
EDID Emulation and Firewall
HSL Secure KVM Switch blocks the computer access to the shared
display by using isolated EDID emulators. This arrangement together
with the internal EDID firewall protects from KVM attacks targeting
the external memory effect of the shared display.
USB Ports Protection
Console USB ports are protected from the use of storage and other
unsafe USB devices through strong filtering (independent of
computer protection means). Unqualified devices are rejected when
connected to the Switch. Only mouse and keyboard data are passed
through.
Heavy-duty Steel Enclosure
HSL Secure KVM Switches uses thick steel components to protect the
product from physical tampering and to minimize radiated
electromagnetic emissions that can be snooped or intercepted.
Active Always-On Anti-Tamper
Active chassis anti-tamper system prevents the KVM electronic
circuitry from being accessed and tampered with by permanently
disabling the product once tampering is detected.
Holographic Tamper-Evident Labels
Four serially numbered holographic security tamper-evident labels
are placed on the enclosure surface to provide a visual indication if
the Switch has been opened or compromised.

5
Secure Combiner KVM Switch User Manual
High Inter-Channel Analog Isolation
HSL Secure KVM Switches offers exceptionally high isolation between
computer channels to prevent analog leakages across the KVM.
Dedicated Peripheral Port
HSL patented Dedicated Peripheral Ports enables secure use of CAC
or smart-card readers leveraging security.
Common Criteria Listing
The Switch is listed by the Common Criteria organization.

6
Secure Combiner KVM Switch User Manual
Main Features
The HSL Secure KVM Switch was designed with the user in mind for
today’s IT environment. Below is a summary of some of the features
incorporated into the Product.
Video Support
DVI models support DVI-I displays as well as VGA and HDMI
via compatible cables.
Dual Display and Resolutions Supported
Products supports dual display and video resolutions of up to HD
(1920 X 1200 pixels).
Real-time and real quality video
Pixel-by-pixel video image. No quality loss, latency, reduced colors,
dropped frames or artifacts. Fastest digital video processing
technology available in any KVM today. Less than 30 millisecond
latency.
Easy customization
Administrator mode enables easy customization of channels, colors,
cursors, task-bar, background etc. User programmable buttons
enable quick setting of user defined screen arrangements.
Audio Support
The HSL Secure KVM Combiner supports audio out switching.
Microphone switching is not supported to prevent analog leakages
through audio ports.
Advanced Scaling Function
The HSL Secure KVM Combiner has an advanced scaling function
allowing the user to scale the video source 2x and 4x smaller to assure
good view and superb work experience. User can now fit 4 full HD
sources on a single HD screen by scaling each source and all in real
time with no data loss.
Scale and Tile Modes
Allowing users to focus on a main source while viewing the other
sources or tile all of the sources equally
DPP port
Dedicated peripheral port enables to connect CAC and smart card
readers to product. Product is designed with complete isolation
between DPP data, such as user authentication smart card reader
data, and all other product traffic.

7
Secure Combiner KVM Switch User Manual
Equipment Requirements
Cables
It is highly recommended to use HSL Cable Kits for product to ensure
optimal security and performance.
One Cable Kit is required per connected computer.
Operating Systems
Product is compatible with devices running on the following
operating systems:
• Microsoft® Windows®
• Red Hat®, Ubuntu® and other Linux® platforms
• Mac OS® X v10.3 and higher.
USB Keyboard console port
The product console USB keyboard port is compatible with Standard
USB keyboards.
Notes:
a. For security reasons products do not support wireless
keyboards. In any case do not connect wireless keyboard to
product.
b. Non-standard keyboards, such as keyboards with integrated
USB hubs and other USB-integrated devices, may not be fully
supported due to security policy. If they are supported, only
classical keyboard (HID) operation will be functional. It is
recommended to use standard USB keyboards.
USB Mouse console port
The product console USB mouse port is compatible with standard
USB mice.
Notes:
a. Console USB keyboard and mouse ports are switchable, i.e.
you can connect keyboard to mouse port and vice versa.
However, for optimal operation it is recommended to
connect USB keyboard to console USB keyboard port and
USB mouse to console USB mouse port.
b. Console USB mouse port supports Standard KVM Extender
composite device having a keyboard/mouse functions.
c. For security reasons products do not support wireless mice.
In any case do not connect wireless mouse to product.
PS/2 Mouse and Keyboard console ports
The product console PS/2 keyboard and mouse ports are compatible
with standard PS/2 keyboards and mice.
Video Support
Combiners supports DVI-I displays as well as VGA and HDMI
via compatible cables.
Resolutions Supported
DVI Dual-link supports resolution up to 2560 x 1600.
DVI Single-link supports resolution up to 1920x1200.
User Audio Devices
Product is compatible with the following types of user audio
devices:
Stereo headphones;
Amplified stereo speakers.
Note: In any case do not connect a microphone to product audio
output port including headsets.
DPP Port
The product operates with authorized USB devices plugged into the
console DPP Port, such as USB smart-card reader or Common Access
Card (CAC) reader.

8
Secure Combiner KVM Switch User Manual
Safety Precautions
Please read the following safety precautions carefully before using
the product:
Before cleaning, disconnect the product from DC
power.
Be sure not to expose the product to excessive
humidity.
Be sure to install the product on a clean secure
surface.
Do not place the DC power cord in a path of foot
traffic.
If the product is not used for a long period of time,
remove the product’s wall-mount power supply from
the mains jack.
If one of the following situations occurs, get the
product checked by a qualified service technician:
The product’s power supply is overheated,
damaged, broken, causes smoke or shortens
the mains power socket.
Liquid penetrates the product’s case.
The product is exposed to excessive moisture
or water.
The product is not working well even after
carefully following the instructions in this
user’s manual.
The product has been dropped or is physically
damaged.
The product has obvious signs of breakage or
loose internal parts.
The product should be stored and used only in
temperature and humidity controlled environments
as defined in the product’s environmental
specifications.
The wall-mount power supply used with this product
should be the model supplied by the manufacturer
or an approved equivalent provided by HSL or an
authorized service provider. The use of improper
power source will void product warranty.

9
Secure Combiner KVM Switch User Manual
Front Panel Features
1 –Steel enclosure
2 –DPP (Dedicated Peripheral Port) Status LED ("Freeze")
3 –DPP channel select LEDs
4 –Channel Select push-buttons and LEDs
5a-5b –Holographic Tamper Evident Labels
1
2
3
5b
4
5a

10
Secure Combiner KVM Switch User Manual
Rear Panel Features
Model shown K424F
Console Area
1 - DPP (Dedicated Peripheral Port) console USB jack
2 - RDC remote control port RJ-45 (for future use)
3 –Audio console output 3.5 mm stereo jack
4 - USB Keyboard & Mouse jacks
5 –PS/2 Keyboard & Mouse jacks (Mini-DIN)
6 –Console 2 X DVI-D video input jacks & diagnostic LEDs
2
4
5
6
Computer Area
7 - Computer USB Keyboard & Mouse jack
8 - Computer audio input jack 3.5mm stereo
9 - Computer DPP USB jack
10 - Computer DVI-D video input jack
General
11 - DC Power input jack –barrel type
12 –Restore Factory Default
10
11
3
1
8
7
9
12

11
Secure Combiner KVM Switch User Manual
Tamper Evident Labels
HSL Secure KVM Switch uses 4 holographic tamper evident labels to
provide visual indications in case of enclosure intrusion attempt.
These labels indicate white dots or the text “VOID” once removed.
When opening product packaging inspect the 4 tampering evident
labels.
If for any reason one or more tamper-evident label is missing,
appears disrupted, or looks different than the example shown here,
please call HSL Technical Support and avoid using that product.
HSL Holographic Tampering Evident Label
Active Anti-Tampering System
HSL Secure KVM Switch is equipped with always-on active anti-
tampering system. If mechanical intrusion is detected by this
system, the Switch will be permanently disabled and LED will blink
continuously.
If product indication tampered state (all LEDs blinking) - please call
HSL Technical Support and avoid using that product.

12
Secure Combiner KVM Switch User Manual
Product Specifications
Enclosure Heavy-duty extruded aluminum
enclosure with metal faceplate
Power Requirements 12V DC, 5A (maximum) power adapter
with center-pin-positive polarity
AC Input 100 to 240VAC
No. of Secure Channels 4
No. of Computers Supported 4
Displays Supported
K404F: 1 x single-link DVI-D display;
HDMI interface supported with
adapter
K424F:
2 x single-link DVI-D display; HDMI
interface supported with adapter
Output Display Resolutions Supported Up to 1920x1200 pixels
Input video resolution Up to 1920x1200
Input Windows Size 800 x 600 (4:3) SVGA; or
1280 x 1024 (5:4) SXGA; or
1920 x 1080 (16:9) HD1080;
or
1920 x 1200 (16:10) WUXGA.
Console Keyboard Input USB Type-A female connector or PS/2
Mini-DIN 6 pin female connector
Console Mouse Input USB Type-A female connector or PS/2
Mini-DIN 6 pin female connector
Console DPP Input USB Type A
Console Display Port 1 DVI-D female connector (K404F)
2 DVI-D female connector (K424F)
Console Audio out 3.5mm stereo jack
PC Keyboard/Mouse Ports USB Type-B jack
PC CAC Ports USB Type-B jack
PC Audio Input 3.5mm stereo jack
PC Video Input Port DVI-D Single-link female
Port Selectors push-buttons 4
LED Indicators 4
User Functions
Toggling between normal mode and
system modes by mouse side buttons
click (5-Buttons mouse).
Windows can be moved and resized.
Cascading button arranges all 4
windows one on top of the other.
Tile button arranges all 4 windows in a
mosaic.
Help button presents on-screen basic
usage guidance.
Vertical and horizontal scroll bars to
enable user control of viewable
window.
Minimize window to task-bar.

13
Secure Combiner KVM Switch User Manual
Colored Task-bar and window border
indicating channel.
Mouse wheel cyclic toggling between
active windows in system mode.
Double click to maximize a window to
a full screen.
Legacy mode –toggling between
windows by keyboard Control +
Function keys [Optional].
3 User defined preset buttons to save
or load user settings.
Disable channel function.
Administrator mode
Selectable system cursor pointers.
Selectable window border widths.
Selectable window border colors.
Selectable task-bar sizes.
Selectable video output resolutions
[model specific –see table above].
Operating Temp 32° to 104° F (0° to 40° C)
Storage Temp -4° to 140° F (-20° to 60° C)
Humidity 0-80% RH, non-condensing
Security Accreditation NIAP Common Criteria
Product design life-cycle 10 years per

14
Secure Combiner KVM Switch User Manual
Before Installation
Unpacking the Product
Before opening the product packaging, inspect the packaging
condition to assure that product was not damaged during delivery.
When opening the package, inspect that the product Tamper Evident
Labels are intact.
Where to locate the Product?
The enclosure of the product is designed for desktop or under the
table configurations. An optional Mount Kit is available.
Product must be located in a secure and well protected environment
to prevent potential attacker access.
Consider the following when deciding where to place product:
Product front panel must be visible to the user at all times.
The location of the computers in relation to the product and
the length of available cables (typically 1.8 m)
Warning: Avoid placing cables near fluorescent lights, air-
conditioning equipment, RF equipment or machines that create
electrical noise (e.g., vacuum cleaners).
Display selection considerations
Proper selection of user display is critical for the success of any
Combiner KVM deployment. The information provided here
represents the information gained during evaluation and deployment
projects.
•Avoid using old CRT displays.
•Some projects invested significant resources in the overall project
design and implementation but neglected the display and
peripherals. Users may reject the new system if proper display not
used with the system. As large LCD cost going down daily, it become
easier and cheaper to retrofit the user desktop completely during
these projects.
•Proper size of the display is critical. To enable simultaneous work
with several windows LCD panels larger than 22” diagonal are
recommended.
•Try to use the larger LCD size possible (taking the user workstation
/ table size into consideration).
•Check if the display adjusts automatically to resolution changes.
This feature is essential to support window maximization.
•Native resolution of the display should match output resolutions
supported by the Secure Combiner KVM.
•Display should support DVI input. HDMI can be used with proper
DVI to HDMI cable or adapter. In this case check audio out channels
cannot be routed through HDMI.
•It is recommended to involve the users in the display selection
process during evaluation and initial deployments.
•Consult support with specific display models and technical
specifications.
•DVI-I to VGA converters cannot be used with the Secure Combiner
KVM as it does not support analog video.
•Note that when using a Dual-link DVI display with the 104X product
the KVM to display cable and KVM cables must be Dual-link as well.

15
Secure Combiner KVM Switch User Manual
Dual Display Model K424F
•K424F uses two displays. It is preferable that both displays will be
the same type and model.
•Displays must be landscape oriented and installed side by side in
close proximity to one another. Primary on the left and secondary on
the right side.
•Displays must be either 1920 x 1080 or 1920 x 1200 native
resolution.

16
Secure Combiner KVM Switch User Manual
Installation
Connecting devices to product console
Product requires connection of all devices and computers prior to
powering it up.
Note: some devices such as user display would not be recognized if
connected after product is already powered up.
See figures above for connector locations.
Connect user display/s. Mark which display is coupled with which
computer. It is also recommended to mark which computer is
coupled with which channel.
Connect user keyboard and mouse to console keyboard and
mouse ports.
Connect headphones/speakers to console audio out port
(optional).
If the computer uses a smart card reader/USB device, connect
the smart card reader/USB device to the console DPP port
(optional, model pending).
Notes:
1. Console USB mouse and keyboard ports are switchable, i.e. you
can connect keyboard to mouse port. However, for optimal
operation it is recommended to connect USB keyboard to
console USB keyboard port and USB mouse to console USB
mouse port.
2. For security reasons products do not support wireless keyboards.
In any case do not connect wireless keyboard to product.
3. Non-standard keyboards, such as keyboards with integrated USB
hubs and other USB-integrated devices, may not be fully
supported due to security policy. If they are supported, only
classical keyboard (HID) operation will be functional. It is
recommended to use standard USB keyboards.
4. Console USB mouse port supports Standard KVM Extender
composite device having a keyboard/mouse functions.
2. Connecting the Computers
Using USB cables, connect each computer to the USB type B port
in "computer interface ports" area on product.
If computer uses audio output, e.g. speakers/headphones,
connect audio cable from its audio output port to the
corresponding audio input port on product.
If the computer uses a smart card reader/USB device, connect a
USB cable between the DPP-enabled computer and the
corresponding DPP port on product.
Note:
1. If the number of product channels is larger than the number
of sources used, make sure the computers are connected in
a row starting from computer #1. For example, if there are 3
channels used, connect computers to channels #1, #2 and
then #3.
2. The USB cable must be connected directly to a free USB port
on the computer, with no USB hubs or other devices in
between.
3. Power up
Connect DC power supply.
Power up user display/s. Select through display setup menu the
appropriate video input if applicable.
Power up the connected computers.
Power up the product.

17
Secure Combiner KVM Switch User Manual
When you power up your computers, the product emulates display,
mouse and keyboard on each port and allows your computers to boot
normally. You should be able to move the mouse cursor on the
primary display connected to computer #1.
Check to see that the keyboard and mouse are working properly on
each computer.
Repeat this check with all occupied ports to verify that all computers
are connected and responding correctly.
If you encounter an error, check your cable connections for that
computer and reboot. If the problem persists, please refer to the
Troubleshooting section in this User Manual.
DPP Installation
In case computer and product support DPP functionality, such as
user authentication smart card reader, do the following:
1. Connect USB device, such as smart card reader, to DPP port
on product console
2. Connect DPP input port on product to any free USB port on
computer using a USB cable.
Note: Do not connect the USB cable if DPP functionality is
not needed for that computer.
If only some of the computers use DPP functionality, such as user
authentication, make sure that computer #1 is connected to the USB
device. If needed, switch channels/computer mapping to create this
configuration.
When product is powered ON and connected USB device is qualified
and ready for use, the DPP status LED ("Freeze") will illuminate steady
green.
If the USB device is detected but not authorized, as not being a
Smart Card or CAC reader, it will be rejected for security reasons.
This will be indicated by DPP status LED illuminating steady red.
Note: If during installation as a result of bad output resolution
(resolution not supported by display) the video image on the user
display is lost it is possible to recover the device through the use of
Restore Factory Defaults switch (see item 17 in page 12). Pressing
this switch momentarily will return the Secure Combiner KVM to
the original production settings including lowest output resolution.
For information on how to reset the device to factory defaults see
the Troubleshooting section of this manual.

18
Secure Combiner KVM Switch User Manual
Typical system diagram

19
Secure Combiner KVM Switch User Manual
Administrator Setup
Now that the Secure Combiner KVM is connected and powered-on
it is a good opportunity to setup some operational settings.
To enter administrator setup mode the administrator key should be
inserted into the front panel keylock and rotated in clockwise
direction. Once in administrator clicks on setup icon at the bottom
left side of the screen, the Main Admin Setup windows appears and
can be accessed. Details about administrator setup windows:
Main Admin Menu –Enables selection of System setup
window or channel specific window using mouse.
Channel menu –Enables selection of channel input
resolution (4 options) and border color from 16 color
options.
System menu –Enable system level settings. Administrator
can select:
- Display output resolution from 2/6/8 options;
- Border width from 6 options;
- Taskbar size from 2 options; and
- System cursor type from 4 options.
Note: Rotation of the key lock to Administrator setup mode also
affect: the following:
1. User preset buttons will become inactive.
2. All three user presets will be erased.
This is normal system behavior that designed to avoid configuration
conflicts.
Note about input resolution setting: Selection of input resolution
that does not match the attached PC will result unreadable image at
that window. This may be fixed by entering administrator mode and
change input resolution setting or by changing host resolution.
Notes about display resolution setting:
- The Secure Combiner KVM channel resolution, selected from the
channel menu, determines the size of the channel window. It will not
affect the actual resolution projected by the connected PC.
- The Secure Combiner KVM is capable of scaling the image in two
possible factors: 2x and 4x allowing the user to fit more information
on the same display size.
- Selection of resolution higher or lower than resolution range of
connected display may result image loss! In this case you can change
display to different type or restore factory defaults.
- To restore factory default settings –use a paper clip or another
sharp object and press momentarily the recessed RFD switch located
at the rear side above the DC power jack.
- See table in page 14 for supported output resolutions per model.
Once completed to set the required settings, the administrator key
should be rotated back to the locked position and key must be
removed to enable normal product operation.
After Installation Checklist
Once completed to set requires settings –check the final device
product configuration with all connected computers operating:
1. Check that each window is connected to the proper PC and have
the required border color.
2. Check that each window is coupled to the proper keyboard and
mouse (no cables are crossed between channels).
3. Check that each window is coupled to the proper DPP input.

20
Secure Combiner KVM Switch User Manual
4. Check that each window is coupled to the proper audio output (if
applicable).
5. Check that all video cable thumb screws are secured.
6. Check that administrator key was removed from the device.
Dual Display Channel #1 Input resolution setting window
Installation is similar to a single display with the following changes:
1. Displays must be either 1920 x 1080 or 1920 x 1200 native
resolution. Do not use higher resolution as the image will be shown
as a smaller window or will be rescaled (resulting a degradation in the
displayed video quality.
2. It is recommended that both displays will be identical type and
model.
3. Displays should be oriented in landscape.
4. Left side display must be connected to the primary console display
output jack (the right side jack when looking from the rear).
5. Conversion to VGA monitor is not recommended.